Kind cluster nodes cannot reach external registries via bridge network (EOF/timeout)

[kayadogan1]

Description

When running a Kind (Kubernetes in Docker) cluster on OrbStack, the Kind nodes are unable to reach any external HTTPS endpoint including Docker Hub (registry-1.docker.io). This prevents the cluster from pulling container images at runtime.

DNS resolution works correctly through OrbStack's internal resolver (0.250.250.254), but TCP/HTTPS connections timeout or fail with TLS errors.

Environment

• OS: macOS (Apple Silicon / arm64)
• OrbStack Docker Engine: 29.4.0
• containerd: v2.2.2
• Kind: v0.32.0
• Kind Network: bridge, subnet 192.168.97.0/24, created 12 days prior
• Node Image: kindest/node:v1.36.1

Steps to Reproduce

1. Create a Kind cluster with multiple nodes:

   kind create cluster --name kind

2. Deploy any pod that requires pulling an image from Docker Hub
3. Observe ErrImagePull / ImagePullBackOff with EOF errors

Diagnostic Results

DNS Resolution — ✅ Working

$ docker exec kind-worker getent ahosts registry-1.docker.io
44.207.198.110  STREAM registry-1.docker.io
18.213.142.16   STREAM
# ... (IPv4 addresses resolved correctly)

resolv.conf

$ docker exec kind-worker cat /etc/resolv.conf
nameserver 0.250.250.254
options ndots:0
# Based on host file: /etc/resolv.conf (internal resolver)

HTTPS Connectivity — ❌ Failed

$ docker exec kind-worker curl -sI --connect-timeout 5 https://registry-1.docker.io/v2/
# Exit code: 35 (SSL/TLS connection error)

$ docker exec kind-worker curl -sI --connect-timeout 5 https://google.com
# Exit code: 35

$ docker exec kind-worker curl -4 -sI --connect-timeout 5 https://registry-1.docker.io/v2/
# Exit code: 28 (Connection timeout)

Routing — Exists but no connectivity

$ docker exec kind-worker ip -4 route show default
default via 192.168.97.1 dev eth0

$ docker exec kind-worker ip -6 route show default
default via fc00:f853:ccd:e793::1 dev eth0 metric 1024 pref medium

Network Config

$ docker network inspect kind
# EnableIPv4: true, EnableIPv6: true
# Subnet: 192.168.97.0/24, Gateway: 192.168.97.1
# com.docker.network.bridge.enable_ip_masquerade: true
# MTU: 1500

Kubernetes Event Errors

Failed to pull image "redis:7-alpine": failed to resolve reference
"docker.io/library/redis:7-alpine": failed to do request:
Head "https://registry-1.docker.io/v2/library/redis/manifests/7-alpine": EOF

Expected Behavior

Kind nodes should be able to reach external HTTPS endpoints (Docker Hub, etc.) through OrbStack's NAT/bridge network, similar to how regular Docker containers can.

Notes

• Regular docker pull from the host works fine
• System containers within Kind (coredns, kindnet, kube-proxy) work because their images are pre-loaded
• The Kind network was created 12 days ago; the issue may be related to an OrbStack update or network state drift
• Workaround: Pre-loading images using docker save | docker exec -i <node> ctr --namespace=k8s.io images import --digests -